Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 278
Reset filtersSpring Cloud Config has an Authorization Bypass Through User-Controlled Key
Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)
jdbi3-freemarker Vulnerable to Improper Neutralization of Special Elements Used in FreeMarker Template Engine
Geyser Vulnerable to Server-Side Request Forgery (SSRF) via Player Head Texture URL in Geyser
Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection
Silverpeas Core has a reflected cross-site scripting vulnerability
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix
Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata
Warm-Flow has a SpEL Expression Injection in SpelHelper.parseExpression
Spring Cloud Gateway's SSL bundle configuration silently bypassed
Apache Tomcat has an HTTP Request/Response Smuggling vulnerability
Emissary has GitHub Actions Shell Injection via Workflow Inputs
Emissary has Stored XSS via Navigation Template Link Injection
Undertow is Vulnerable to HTTP Request/Response Smuggling
Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows
org.eclipse.jetty:jetty-http has different parsing of invalid URIs
The Eclipse Jetty Server Artifact has a Gzip request memory leak
Apache ActiveMQ is Vulnerable to Integer Overflow or Wraparound
Neo4j Enterprise and Community editions have insufficient escaping of unicode characters in query log
Neo4j Enterprise and Community vulnerable to a potential information disclosure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.